The financial hit needn't be disastrous. One would have thought Tesco had insurance!
Tesco's strategic response will be more about reputation, branding and customer relationships than about the direct profits they earn from their financial services.
I would be surprised if Her Majesty's Government started micromanaging security (unless there was political pressure to do so). That's not their style. Much better to require that banks, and their customers, are adequately insured against this kind of fraud, and then let the invisible hand decide the optimum level of security.
How would one launder so much stolen bank account credit so quickly? It depends on whether you need to remain anonymous or not. If, say, you're an established Russian gangster with an established network of ATM withdrawal agents, it's relatively straightforward. Sure, some of the agents will get caught, but that's their problem, not yours.
On the other hand, if you're within reach of British justice, I guess we're talking about Bitcoins. Can the scammers move their stolen cash to a Bitcoin market that's large enough and liquid enough to swallow that much transaction volume before the cash is frozen? I've no idea.
If I was a legislator, I would look for ways to attack bitcoin laundering / tumbling. Bitcoin transactions are anonymous, but they are also public. It's always possible to look at the Bitcoins in your wallet and see if they are in any way tainted by association with known dirty money.